275d7198ec86ab203e2d2847caf6a520f7c51351a5d86c1f6eccb8409b30cefc

General

Target
2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample261001-y2dc1sswhy
SHA256 275d7198ec86ab203e2d2847caf6a520f7c51351a5d86c1f6eccb8409b30cefc
MD5 fe38ee2b878f2d12a7489a65df975e70
SHA1 48f61e0f6fcee408f18c856b2844c17d5103b88a
SHA512 97153c1effdf8d3f04247f0dda71d1eeef15d8c87265e26071906422967476d737bf4e8c6e503463f64747da3bfa19b3d3c495448b61400e0979305b26ee225e
SSDEEP 98304:00nAAYEpHhg9OU/jIEeQfoR/IuOFVjUu5r:BNI9FIF0wuB
TLSH
T1F8F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4276	original_temp.exe
4760	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4760	original_temp.exe
4760	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 4276	1108	2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4276 wrote to memory of 4760	4276	original_temp.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\jds240690593.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240690593.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_381\au.msi
Size 853KB
SHA256 9d4d672be69c91207923ef3540af4750322c43e0a3440126fbf5b4962c8c3052
MD5 b1a4cf35bc6913071ee217125bcc6788
SHA1 4818a036d75aa943e92353b638ffd1636ba46c49
SHA512 5bfde958292748f666d61b72401426bc5ab4bd564299e806d9c05722812156d6f7742bd2482fca308fc10cc27747a1f0b216a4a2596540cc987b5402c4fcea04
SSDEEP 24576:le/bE//5CbZtbotwXYMNMUEcF72VUnVMM:o/4n5mbbX3MFcF72GnuM
TLSH
T15B0533D266E539100CD0E7B0A253A67C90FE774A3460996044637675CB0FBCB67ABB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA489.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXA489.tmp
Size 1.1MB
SHA256 e3ed70ef2244108c9c818cc598a6b8c2fb9f75b6a419ac362559bf38b1518837
MD5 1332df4e845555717ffbe8b5303a61cc
SHA1 1fcb613ad2f185e0e1a382177681bcfd981aefe8
SHA512 47eeded7d808a2c9ac1b50f610bb26d9022bea1da703cd293a9826a189fb4cafcaf13ebf006d43b8c90fe5c282217eb57dcf6fbd1575bf5e4691db8dd9f9b742
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wlD:66F0eMpAAYEhpphw1
TLSH
T173456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240690593.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 76bbb558f944664442d41a751b02b5715bf9289922f5018c8ab2853eb2427e6b
MD5 89eb388e71139632cb97e2c049abeebc
SHA1 77330a4cf58993b57953ab2490439c8eda2d4c16
SHA512 6686abb72651f65d9c5c9955c8e308d52c6200cd11d19385d05d69a4cf2fc71ff8fbbd9b24a656018762ea654298827fbf72482a513180c4c2251458e7ad9f39
SSDEEP 3072:8oB5+7tzxIN8YhUtiwRTiLacdlvkkegiwvSGhCo47n69R:bNtmQ
TLSH
T16FF365C7D9AD44FF24234BA3C7695C6406521A2E436E4A2D31EF92CEA151E03C95ECFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 80e3685860005e878808a9f63e8bf9badf6688219ff9917d4c76ff811f3895e4
MD5 1e2eeaba838fa734ecf1f2a34da5efe9
SHA1 0849d22a48d888a68d0b93ea4df82f8e464892f0
SHA512 1a7e0699d063fdcae54e2fc0cd45ccf509745206af3be58fe30560c4636bd9926efee1e9be70471571b408e767a241e906b0c691adad76cc986084010b7f1b52
SSDEEP 3072:8oB5+7tzxIN8YhUtiwRTiLacdlvkkegiwvSGhCo47n693:bNtmg
TLSH
T119F376C7D9AD44FF24234BA3C7695C6406521A2E436E4A2D31EF92CEA151E03C95ECFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 3.3MB
SHA256 275d7198ec86ab203e2d2847caf6a520f7c51351a5d86c1f6eccb8409b30cefc
MD5 fe38ee2b878f2d12a7489a65df975e70
SHA1 48f61e0f6fcee408f18c856b2844c17d5103b88a
SHA512 97153c1effdf8d3f04247f0dda71d1eeef15d8c87265e26071906422967476d737bf4e8c6e503463f64747da3bfa19b3d3c495448b61400e0979305b26ee225e
SSDEEP 98304:00nAAYEpHhg9OU/jIEeQfoR/IuOFVjUu5r:BNI9FIF0wuB
TLSH
T1F8F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-425-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads